Bug 1055306 - Make h2 push origin check more correct. r=mcmanus

This commit is contained in:
Nicholas Hurley 2014-11-03 16:19:00 +01:00
parent 0df6da7ff6
commit 6e9d702614
3 changed files with 67 additions and 4 deletions

View File

@ -29,6 +29,8 @@
#include "nsISSLStatus.h"
#include "nsISSLStatusProvider.h"
#include "nsISupportsPriority.h"
#include "nsStandardURL.h"
#include "nsURLHelper.h"
#include "prprf.h"
#include "prnetdb.h"
#include "sslt.h"
@ -1629,7 +1631,23 @@ Http2Session::RecvPushPromise(Http2Session *self)
return NS_OK;
}
if (!associatedStream->Origin().Equals(pushedStream->Origin())) {
nsRefPtr<nsStandardURL> associatedURL, pushedURL;
rv = Http2Stream::MakeOriginURL(associatedStream->Origin(), associatedURL);
if (NS_SUCCEEDED(rv)) {
rv = Http2Stream::MakeOriginURL(pushedStream->Origin(), pushedURL);
}
LOG3(("Http2Session::RecvPushPromise %p checking %s == %s",
associatedStream->Origin().get(), pushedStream->Origin().get()));
bool match = false;
if (NS_SUCCEEDED(rv)) {
rv = associatedURL->Equals(pushedURL, &match);
}
if (NS_FAILED(rv)) {
// Fallback to string equality of origins. This won't be guaranteed to be as
// liberal as we want it to be, but it will at least be safe
match = associatedStream->Origin().Equals(pushedStream->Origin());
}
if (!match) {
LOG3(("Http2Session::RecvPushPromise %p pushed stream mismatched origin "
"associated origin %s .. pushed origin %s\n", self,
associatedStream->Origin().get(), pushedStream->Origin().get()));

View File

@ -27,6 +27,7 @@
#include "nsHttpHandler.h"
#include "nsHttpRequestHead.h"
#include "nsISocketTransport.h"
#include "nsStandardURL.h"
#include "prnetdb.h"
#ifdef DEBUG
@ -241,6 +242,28 @@ Http2Stream::WriteSegments(nsAHttpSegmentWriter *writer,
return rv;
}
nsresult
Http2Stream::MakeOriginURL(const nsACString &origin, nsRefPtr<nsStandardURL> &url)
{
nsAutoCString scheme;
nsresult rv = net_ExtractURLScheme(origin, nullptr, nullptr, &scheme);
NS_ENSURE_SUCCESS(rv, rv);
return MakeOriginURL(scheme, origin, url);
}
nsresult
Http2Stream::MakeOriginURL(const nsACString &scheme, const nsACString &origin,
nsRefPtr<nsStandardURL> &url)
{
url = new nsStandardURL();
nsresult rv = url->Init(nsIStandardURL::URLTYPE_AUTHORITY,
scheme.EqualsLiteral("http") ?
NS_HTTP_DEFAULT_PORT :
NS_HTTPS_DEFAULT_PORT,
origin, nullptr, nullptr);
return rv;
}
void
Http2Stream::CreatePushHashKey(const nsCString &scheme,
const nsCString &hostHeader,
@ -249,9 +272,22 @@ Http2Stream::CreatePushHashKey(const nsCString &scheme,
nsCString &outOrigin,
nsCString &outKey)
{
outOrigin = scheme;
outOrigin.AppendLiteral("://");
outOrigin.Append(hostHeader);
nsCString fullOrigin = scheme;
fullOrigin.AppendLiteral("://");
fullOrigin.Append(hostHeader);
nsRefPtr<nsStandardURL> origin;
nsresult rv = Http2Stream::MakeOriginURL(scheme, fullOrigin, origin);
if (NS_SUCCEEDED(rv)) {
rv = origin->GetAsciiSpec(outOrigin);
outOrigin.Trim("/", false, true, false);
}
if (NS_FAILED(rv)) {
// Fallback to plain text copy - this may end up behaving poorly
outOrigin = fullOrigin;
}
outKey = outOrigin;
outKey.AppendLiteral("/[http2.");

View File

@ -10,6 +10,8 @@
#include "nsAHttpTransaction.h"
#include "nsISupportsPriority.h"
class nsStandardURL;
namespace mozilla {
namespace net {
@ -133,6 +135,13 @@ public:
Http2Session *Session() { return mSession; }
static nsresult MakeOriginURL(const nsACString &origin,
nsRefPtr<nsStandardURL> &url);
static nsresult MakeOriginURL(const nsACString &scheme,
const nsACString &origin,
nsRefPtr<nsStandardURL> &url);
protected:
static void CreatePushHashKey(const nsCString &scheme,
const nsCString &hostHeader,